Comment by ekiru

Yes, the server can straightforwardly, any time you load the application, serve to you (including to specifically you, a single target, making it much less likely to be noticed), a modified version of the JavaScript powering that client-side encryption which will send the plaintext off to the server.